The GDPR FAQ?

What is the purpose of the GDPR?

Protect citizens against malicious uses of their personal data and hold organizations accountable. Indeed, they must ensure optimal data protection and be able to demonstrate it (documentation).

How to understand “personal data”?

Personal data is any information relating to an identified or identifiable natural person. Indeed, a natural person can be identified directly or indirectly (e.g. name, identification number, location data, online identifier, elements specific to their physical, physiological, genetic, psychological, economic, cultural or social identity). Thus, identifiers such as an IP address are likely to at least indirectly identify a natural person.

LAre territories impacted by the GDPR?

The GDPR lays down particularly broad territorial criteria. Also, the GDPR covers almost all processing carried out by actors located in the European Union or relating to people located in this territory.

What are the treatments concerned?

Since May 25, 2018, all structures that process personal data are required to comply with the GDPR.
In addition, the GDPR applies to automated processing of personal data and non-automated processing of this data (contained or intended to appear in a file).

To be compliant, processing must be lawful. What are the conditions?

Any treatment must be either:

• necessary for:
  • safeguarding the vital interests of the person concerned
  • compliance with a legal obligation incumbent on the data controller
  • the management of a public service mission, a mission of public interest relating to the exercise of public authority vested in the controller
  • the execution of a contract to which or pre-contractual measures,
  • the legitimate interest pursued, subject to preserving the interest or the fundamental rights and freedoms of the data subject
• have received the prior consent of the data subject.

What new obligations?

Organizations have the following obligations:

1. designate a data protection officer (DPO) for certain organizations
2. keep a processing register when they have more than 250 employees or carry out certain types of processing
3. implement internal procedures to ensure data protection from the design of processing
4. carry out impact analyzes prior to the implementation of certain treatments
5. review the information notices, as well as the methods for obtaining consent for processing subject to consent.
6. set up a CNIL notification system in the event of a data breach creating a risk for the rights and freedoms of natural persons (notification extended to all of them if this risk is high).
7. establish written contracts with subcontractors and with joint data controllers clearly dividing the roles and responsibilities of each.

Who should appoint a DPO?

The organizations:

• • which are “public authorities or public bodies, with the exception of courts acting in the exercise of their jurisdictional function” (including private law bodies in charge of a mission of public interest or exercising prerogatives of public power)
  • whose basic activities consist of “processing operations which, due to their nature, their scope and/or their purposes, require regular and systematic monitoring on a large scale of the persons concerned”
  • whose activity is large-scale processing of categories of sensitive data or data relating to offenses or convictions.

Which organizations are concerned by the processing register?

The processing register is mandatory for all organizations. However, to take into account the particular situation of micro, small and medium-sized enterprises, the GDPR provides an exemption for organizations with fewer than 250 employees. However, these exemptions are not valid if:

1. the processing operations are likely to involve a risk for the rights and freedoms of the persons concerned,
2. if they are not occasional
3. if they relate to the special categories of data referred to in Article 9 paragraph 1 (reveal racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership), the processing of genetic data, biometric data, data concerning health or data concerning the sex life or sexual orientation of a natural person, or data relating to criminal convictions and offenses referred to in Article 10.

When to conduct an impact analysis?

An impact analysis must be carried out for processing operations likely to generate a high risk for the rights and freedoms of natural persons.

What new provisions for subcontractors?

The contract is mandatory. Failing this, each party may be heavily sanctioned. Furthermore, even when subcontractors are not jointly responsible for processing, they may be jointly and severally liable.

What about the sanctions in the event of non-compliance with the provisions of the GDPR?

The GDPR adds two administrative fines whose amount varies depending on the situation, being the greater of the two amounts between:

• 10 million euros and 2% of the total annual worldwide turnover of the previous financial year
• 20 million euros and 4% of the total annual worldwide turnover of the previous financial year

Thus, complex but imperative procedures are required.
We support you in achieving compliance. Contact us!